CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Simple Payment plugin for WordPress is vulnerable to Authentication Bypass in versions 1.3.6 to 2.3.8. This is due to the plugin not properly verifying a user's identity prior to logging them in through the create_user() function. This makes it possible for unauthenticated attackers to log in as administrative users.
Explanation of Vulnerability in Simple Terms
Simple Payment versions 1.3.6 through 2.3.8 contain an authentication bypass vulnerability. An attacker can gain unauthorized access to the payment system without valid credentials. The vulnerability affects confidentiality, integrity, and availability of payment data. Update to a version newer than 2.3.8 immediately.
What an attacker can do
Bypass authentication and gain full access to the payment system without valid credentials.
Potential impact on your site
Attackers can read, modify, or delete payment data and customer information without authorization.
Conditions required to exploit
Network access to the Simple Payment application; no authentication or user interaction required.
Key dates
External resources
